Opinion of the European Central Bank of 21 March 2018 on security and protection of critical infrastructures (CON/2018/15)
Date: 2018-03-21
Institutions: European Central Bank
Subjects: Belgium, financial stability, information security, national law, payment system, public safety

EN 

ECB-PUBLIC 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 21 March 2018 

on security and protection of critical infrastructures  

(CON/2018/15) 

Introduction and legal basis 

On  21  February  2018  the  European  Central  Bank  (ECB)  received  a  request  from  the  Governor  of  the 

Nationale Bank van België/Banque Nationale de Belgique (NBB), acting on behalf of the Belgian Ministry 

of  Finance,  for  an  opinion  on  a  draft  law  (hereinafter  the  ‘draft  law’)  amending  the  Law  of 

11 December 1998  on  security  classification,  security  clearance,  security  certificates  and  security 
advisory  notices  (the  ‘Law  of  11 December  1998  on  security  matters’1)  and  on  a  draft  Royal  Decree 

appointing  the  administrative  authorities  as  competent  to  implement  the  Law  of  11  December  1998  on 

security matters (hereinafter the ‘draft Royal Decree’ and together with the draft law, the ‘draft laws’).  

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning of the European Union and the third, fifth and sixth indents of Article 2(1) of Council Decision 
98/415/EC2, as the draft laws relate to the NBB, payment and settlement systems and rules applicable to 

financial institutions insofar as they materially influence the stability of financial institutions and markets. 

In accordance  with the  first sentence  of Article 17.5  of the  Rules of Procedure  of  the European  Central 

Bank, the Governing Council has adopted this opinion. 

1. 

Purpose of the draft laws 

1.1  The main purpose of the draft laws is to complement the existing legal framework on the protection 

of  the  fundamental  interests  of  the  Belgian  State,  including,  inter  alia,  the  internal  and  external 

security of the State and the integrity of the State’s territory, in the light of growing terrorist threats.  

1.2  Although the Law of 3 May 2005 had already amended the Law of 11 December 1998 on security 

matters  with  a  view  to  creating  a  clearer  and  more  comprehensive  legal  basis  for  the  Belgian 

National Security Authority to conduct security checks of specific natural  persons, this framework 

has proven inadequate to deal with the growing number of requests for security checks.  

1.3 

In order to improve the balance between the respect for the privacy of natural persons subject to 

security checks and the efficiency of these measures, the draft law provides for the designation of 

administrative authorities which will act as a liaison between the National Security Authority and the 

1  

2 

« Loi du 11 décembre 1998 relative à la classification et aux habilitations, attestations et avis de sécurité/Wet van 
11 december  1998  betreffende  de 
  classificatie  en  de  veiligheidsmachtigingen,  veiligheidsattesten  en 
veiligheidsadviezen».  
Council  Decision  98/415/EC  of  29  June  1998  on  the  consultation  of  the  European  Central  Bank  by  national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).  

 
 
 
 
 
                                                 
 
ECB-PUBLIC 

various  sectors  of  activities  falling  within  the  scope  of  the  Law  of  11  December  1998  on  security 

matters and deemed necessary for the protection of the fundamental interests of the State.  

1.4  The  draft  Royal  Decree  designates  the  NBB  as  the  administrative  authority  for  critical  financial 

infrastructures.  The  NBB  has  already  been  designated  as  the  competent  authority  for  critical 

financial  infrastructures  under  the  Law  of  1  July  2011  on  the  security  and  protection  of  critical 
infrastructures3. 

1.5  The  draft law requires the  appointment  of  security officers  within  the  administrative authorities as 

well  as  within  all  public  and  private  legal  entities  falling  within  the  relevant  sectors.  The  draft  law 

outlines  the  procedures  which  will  take  place  between  the  National  Security  Authority,  the 

competent administrative authorities and the legal entities within the relevant sectors, through their 

respective security officers. Upon request by the competent administrative authorities, the relevant 

legal  entities  will  perform  a  preliminary risk analysis  in  order  to  assess  whether the exercise of  a 

profession, function, mission or mandate, the access to premises, buildings, sites or the holding of 

a  permit,  license  or  authorisation  may,  through  inappropriate  use,  undermine  any  of  the 

fundamental interests of the Belgian State. Based on this preliminary risk analysis, the competent 

administrative authority conducts an impact analysis mapping out the effect of potential damages to 

the fundamental interests of the Belgian State. Depending on the results of the impact analysis, the 

competent  administrative  authority  may  propose  to  the  National  Security  Authority  that  individual 

security  checks  be  conducted  with  regard  to  the  exercise  of  a  profession,  function,  mission  or 

mandate, access to premises, buildings or sites or the holding of a permit, license or authorisation. 

If the National Security Authority approves the request, it will conduct itself the security checks of 

specific individuals involved in the exercise of the relevant profession, function, mission, mandate, 

the access to premises, buildings, sites or the holding of a permit, license or authorisation. Some of 

the information gathered as a result of the above-mentioned security checks is available only to the 

security officers of the administrative authorities and the relevant  legal entities, and may be used 

only in the specific context of the draft law. The draft law provides that the costs incurred as a result 

of the security check, which are currently borne by the individual persons subject to check, will be 

paid by the legal entity which employs the relevant individual.  

2. 

General observations 

2.1  The ECB supports the basic purpose of the draft laws to ensure national security in the light of the 

growing  threat  of  terrorism,  including  to  critical  financial  infrastructures.  In  particular,  the  ECB 

welcomes that the draft laws strengthen the protection of critical financial infrastructures at a time 

when terrorism has become a serious threat to the stability of the financial system. 

2.2  The ECB has laid down oversight requirements for systemically important payment systems (SIPS) 
pursuant  to  Regulation  (EU)  No  795/2014  of  the  European  Central  Bank  (ECB/2014/28)4,  which 

addresses  operational  risk,  requiring  SIPS  operators  to  establish,  inter  alia,  (i)  comprehensive 

physical and information security policies that adequately identify, assess and manage all potential 

3   

4  

«  Loi du 1er juillet 2011 relative à la sécurité et à la protection des infrastructures critiques/wet van 1 juli betreffende 
de  beveiliging en de bescherming van de kritieke infrastructuren ».  
Regulation  of  the  European  Central  Bank  (EU)  No  795/2014  of  3  July  2014  on  oversight  requirements  for 
systemically important payment systems (ECB/2014/28), (OJ L 217, 23.7.2014, p. 16), as amended.. 

2 

 
                                                 
ECB-PUBLIC 

vulnerabilities  and  threats  and  (ii)  a  business  continuity  plan  that  addresses  events  posing  a 

significant  risk  of  disrupting  the  SIPS’  operations,  including  the  use  of  a  secondary  site,  and  a 

design that ensures that critical information technology systems can resume operations within two 
hours of those events5. In organising the conduct of security checks for employees of legal entities 

operating  critical  financial  infrastructures,  the  draft  laws  touch  upon  matters  of  national  security 

going beyond the ECB’s oversight requirements.  

2.3  The  tasks  conferred  upon  the  NBB  by  the  draft  laws  appear  to  naturally  complement  the  NBB’s 

existing tasks with regard to the security of critical financial infrastructures, which are carried out by 
the NBB in its capacity as competent authority6 pursuant to the Law of 1 July 2011 on the security 

and protection of critical infrastructures. As the draft laws do not, therefore, confer genuinely new 

tasks on the NBB, the issue of assessing the conferral of new tasks on a national central bank from 

the perspective of the prohibition of monetary financing does not arise in the case at hand.  

3. 

Specific comments 

3.1  The  ECB  understands  that  in  appointing  the  NBB  as  the  competent  administrative  authority  for 

critical  financial  infrastructures,  the  draft  laws  enable  the  NBB,  subject  to  the  approval  of  the 

National Security Authority, to set in motion the performance of security checks intended to assess 

the  potential  risks  associated  with  individuals  working  for  private  and  public  legal  entities  that 

operate  critical  financial  infrastructures.  As  a  liaison  between  the  National  Security  Authority  and 

the security officer for the relevant legal entity, the NBB’s security officer will, for the strict purpose 

of organising the security verification, have access to classified information which would otherwise 

be unavailable.  

3.2  The tasks of the NBB are limited to (i) the performance of part of the preliminary risk analysis; (ii) 

where appropriate, the submission of a proposal to the National Security Authority for the conduct 

of security checks with regard to the exercise of a profession, function, mission, mandate, access 

to premises, buildings, sites, or the holding of a permit, license or authorisation; and (iii) acting as a 

liaison between the relevant legal entity and the National Security Authority. Furthermore, pursuant 

to  Article  9  of  the  draft  law,  the  costs  incurred  in  relation  to  the  security  checks  will  ultimately  be 

borne  by  the  legal  entity  employing  the  individuals  subject  to  the  checks.  Finally,  given  that  this 

new  function  will  be  exercised  with  respect to  financial  institutions  that  are  already  subject  to  the 

supervisory  and  oversight  powers  of  the  NBB,  the  corresponding  expenses  are  expected  to  be 

marginal and to be reimbursed in full by the supervised institutions as provided for in the first and 

second  paragraphs  of Article 12  of the  Royal Decree  of 17  July  2012, as  amended  by  the Royal 

Decree of 5 July 2015, on the coverage of the NBB’s functioning costs derived from the control of 

5  
6  

See Article 15(4)-(5) of Regulation of the European Central Bank (EU) No 795/2014.  
With  regard  to  the NBB’s  role  as  competent  authority  for  the  security  and protection  of  critical  infrastructures, see 
CON/2014/17, paragraphs 3.1 and 3.5.  

3 

 
                                                 
financial  institutions7.  Consequently,  the  draft  laws  would  not  have  an  impact  on  the  financial 

independence of the NBB.  

ECB-PUBLIC 

This opinion will be published on the ECB’s website. 

Done at Frankfurt am Main, 21 March 2018. 

[signed] 

The President of the ECB 

Mario DRAGHI  

7  

Arrêté  Royal  du  17  juillet  2012,  modifié  par  l’arrêt  royal  du  5  juillet  2015,  relatif  à  la  couverture  des  frais  de 
fonctionnement de la Banque Nationale de Belgique liés au contrôle des établissements financiers en exécution de 
l’article  12bis,  §  4  de  la  loi  du  22  février  1998  fixant  le  statut  organique  de  la  Banque  Nationale  de 
Belgique/Koninklijk besluit van 17 juli 2012 gewijzigd bij het koninklijk besluit van 5 juli 2015 betreffende de dekking 
van de werkingskosten van de Nationale Bank van België verbonden aan het toezicht op financiële instellingen, tot 
uitvoering  van  artikel  12bis,  §  4  van  de  wet  van  22  februari  1998  tot  vaststelling  van  het  organiek  statuut  van  de 
Nationale Bank van België ».  

4